Airlock Microgateway is a Kubernetes-native, Envoy-based Web Application and API Protection (WAAP) solution. It operates as a lightweight security gateway and identity-aware reverse proxy, deployed as a container to protect APIs, microservices, and cloud-native applications by filtering malicious traffic and unauthorized access. Designed for containerized and Kubernetes environments, it supports zero-trust architectures through micro-segmentation and decentralized access controls. The system integrates using native components like an Operator, Custom Resource Definitions (CRDs), and the Kubernetes Gateway API, which enables it to function as an ingress controller and support Security as Code approaches within DevOps and GitOps workflows.
The system delivers multi-layer application protection, including defense against OWASP Top 10 threats, OpenAPI specification enforcement, and GraphQL schema validation. It controls access down to the path level by validating identities with protocols such as OIDC, JWT, OAuth 2.0 Token Exchange, and mutual TLS (mTLS), facilitating secure service-to-service communication and identity propagation for single sign-on. The microgateway manages mTLS for client-to-gateway and gateway-to-backend connections, includes session-specific Denial of Service (DoS) protection, provides built-in observability through standardized metrics and logging, and offers experimental HTTP/3 support.
